coop/rose-ash
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

H2: auth-gate cinema/poll admin ops (TDD)

Browse Source 
Failing tests first (6 red: unauth /new-film created a film, etc). new-film / new-showing /
offering-add|update|remove / add-poll / new-event moved from the public route list into
host/blog-write-routes behind protect-html — same gate as every blog write. /vote, /buy-ticket,
/buy stay public (voters + customers) with explicit tests pinning that.

blog suite 234/234 (+9).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
giles
2026-07-03 10:09:58 +00:00
parent 8e0f06aa28
commit eb54d17df9
2 changed files with 43 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
lib/host/blog.sx
View File

@@ -3531,17 +3531,12 @@
(dream-get "/cinema" host/blog-cinema)
(dream-get "/orders" host/blog-orders)
(dream-get "/people" host/blog-people)
(dream-post "/new-film" host/blog-new-film)
(dream-post "/new-showing" host/blog-new-showing)
;; customer/voter ops — deliberately PUBLIC; internal service ops — HMAC-gated (H1).
;; Admin ops (new-film/new-showing/offering-*/add-poll/new-event) are in write-routes (H2).
(dream-post "/buy-ticket" host/blog-buy-ticket)
(dream-post "/offering-add" host/blog-offering-add)
(dream-post "/offering-update" host/blog-offering-update)
(dream-post "/offering-remove" host/blog-offering-remove)
(dream-post "/add-poll" host/blog-add-poll)
(dream-post "/vote" host/blog-vote)
(dream-post "/ticket" (host/blog--protect-internal host/blog-ticket))
(dream-post "/person" (host/blog--protect-internal host/blog-person))
(dream-post "/new-event" host/blog-new-event)
(dream-post "/buy" host/blog-buy)
(dream-post "/order" (host/blog--protect-internal host/blog-order))
(dream-get "/activities" host/blog-activities)
@@ -3577,6 +3572,14 @@
(list
(dream-post "/new" (host/blog--protect-html resolve host/blog-form-submit))
(dream-post "/:slug/allocate" (host/blog--protect-html resolve host/blog-allocate))
;; H2: cinema/poll ADMIN ops — auth-gated like every other write.
(dream-post "/new-film" (host/blog--protect-html resolve host/blog-new-film))
(dream-post "/new-showing" (host/blog--protect-html resolve host/blog-new-showing))
(dream-post "/offering-add" (host/blog--protect-html resolve host/blog-offering-add))
(dream-post "/offering-update" (host/blog--protect-html resolve host/blog-offering-update))
(dream-post "/offering-remove" (host/blog--protect-html resolve host/blog-offering-remove))
(dream-post "/add-poll" (host/blog--protect-html resolve host/blog-add-poll))
(dream-post "/new-event" (host/blog--protect-html resolve host/blog-new-event))
(dream-get "/:slug/edit" (host/blog--protect-html resolve host/blog-edit-form))
(dream-post "/:slug/edit" (host/blog--protect-html resolve host/blog-edit-submit))
(dream-post "/:slug/blocks/add" (host/blog--protect-html resolve host/blog-block-add-submit))